Alerting

Alert when anyone reset password

aalhabbash1
Path Finder

Hi Splunker;

I need to create alert when anyone make reset password for his account in windows logs exception the user did reset password because the his account expired password?

Best Regards;
Abdullah Al-Habbash

Tags (1)
0 Karma

uhaq
Explorer

Would need more information on what sort of monitoring is setup from your domain controllers...

I can break this down to two issues:
1) Passwords resets:
Assuming you are onboarding windows security logs, have you looked at Windows Event ID 4724/4723 for passwords reset?
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4724

2) Accounts expired or near expiration:
Assuming you are onboarding windows security events, there should be an 'Account Expires' field for a user related event, that you can try creating some analytics around.

0 Karma

koshyk
Super Champion

Have a check for EventID 4724
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4724

Please analyse these events and see how your organisation manages password resets
Most of them is done within Active Directory and hence you may need to filter them out. Do try simulating a real reset and see how the data is present for 4724 eventID

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...